Slashdot Mirror
MSN Censors Your IM
Jamie ran across a story about censorship on MSN. Essentially, a number of suspicious strings result in silent failure of delivery. The strings are unsurprisingly things like .scr and .info. They've started maintaining a list if you're interested. Personally, I'd rather they fix the vulnerabilities that make those strings dangerous in the first place: it's not like IM is the only place a URL can get on your machine.
From an article that is linked to from this one:
Or for that matter, http: //tinyurl.com/z35a5.
Kind of reminds me of our software filter where I work. They blocked firefox.exe from running. My solution? I renamed the file to iexplore.exe. Worked like a charm.
It's also probably worth noting that the messages are blocked on the server, not the client. That means that it will block the message whether you're using the MSN client, Pidgin, or any other client to access MSN.
My advice: Get a frickin' Google mail account already and use Google Talk instead.
"Nothing for you to see here. Please move along."
I'm guessing they're using that as a way to make sure only subscribers can get first post now? It wouldn't load for me until someone had posted.
As for the IM... I don't care what it is, it's not their job to censor it. Virus check attachments, sure... But not sensor the chat. Absolutely ridiculous. Reminds me of games that try to filter out all 'bad' words and end up filtering out words like 'fanny' because they mean 'butt' in the US and apparently refer to women's genitalia in the UK. How people NAMED Fanny deal with that, I can't imagine. There were quite a few more commonplace words that mean odd things in other languages or countries and were filtered as well. Ridiculous.
"If you make people think they're thinking, they'll love you; But if you really make them think, they'll hate you." - DM
"Fix the vulnerabilities first"?
WTF you talkin bout. Out of that list used as an example, 5 were PHP security problems (who has PHP installed on the local PC?) one was an odd but normal TLD. One was an executable file.
I'd like to know, how "just fix the software" works in a world where 60% of users don't know about updates, don't update when they do know, or use pirated software the vendor actively blocks from updates.
There are certain strings that have no legit business in MSN chat, that's true. In my opinion, that list doesn't have any of them, AND poses a threat to other stuff aside from the local computer.
God Damn I hate bloggers.
squashed?
And what does every Linux web server come with?
RIGHT...
MSBPodcast.com The opinions expressed here are my own. If you don't like 'em... Think up your own stuff.
And simply renaming worked? Your IT department is pretty inept.
---- Booth was a patriot ----
definitely they do this.
I remember I was trying to send the link to OldApps.com to a friend via MSN IM, and it just wouldn't deliver it.
AC: Here's the link:::
AC: http://www.oldapps.com/
friend: ??
AC: did you got it?
AC: http://www.oldapps.com/
AC: http://www.oldapps.com/
friend: dude? wtf?
AC: God damn it... I'm sending it!
AC: http://www.oldapps.com/
friend: ur a n00b
So I tried downloading the file my self, then sending him (file transfer) to him... and he just wouldn't receive the file transfer window/request.
Stupid MS.
Since the day I became almost crazy when I was trying to pass a URL which included 'download.php?' to a friend from a well trusted website. All of my messages sent back to me. PITA.
Fortunately, it's kinda easily fooled if you randomly place a space and add "delete the space" at the end of the sentence. If they trust me in the first place, what prevents them from copy-pasting it and deleting a character as I requested?
My 0.02 cents
Some time in 2002, if I remember, I wanted to make my MSN Messenger nickname a Microsoft related joke, only to find the client preventing me with a message that says:
:(
"A part of your nickname contains trademarked words and thus cannot be used".
I changed "Microsoft" to "Micro Soft" but it just wasn't the same
I had tried to send my friend a link to a website like site.com/staff.php, and gaim said "blah blah received an error from the MSN switchboard".
Another thing to note: you used to be able to crash people out of chats by typing "[.pif]" (without quotes). It would cause everyone to exit the conversation with a "connection error". Now, it just kicks you out.
Peace sells, but who's buying?
This isn't censorship; it's just a poor firewall. The difference is that the former is for stifling human communication, while the latter is to protect machines from malicious software.
For those who don't have MSN: They changed their mind and it can be done now.
That might be a good start - don't automatically do whatever some random dolt at the other end of a a few TCP connection hops implies you should. Running code just because it was sent to you in a link is downright fucking stupid, yet M$ does it automatically.
Then, fix the rampant security holes in the entire OS that allow someone running as a random user to totally hose the entire OS installation. In other words - get where Unix was, oh, about twenty or thirty years ago.
The fact that M$ has disabled their own apps and OS from doing what they coded it to do is proof that their entire approach to developing software results in insecure products. Time and time again, we see that's true. This is just another example. Why do you "hate" someone who is merely pointing that out?
Do you really think they're diverting resources away from fixing bugs so that they can add "censorship" features to IM? Perhaps this is just one effort among multiple efforts to correct problems AND mitigate their effects? If it's going to take X weeks to fix the bug, but Y days to implement a filter that will stop some large percentage of infections, don't you think that both avenues are worth exploration at the same time? There's more to slowing and preventing the spread of malware than fixing the defect that allows them to propagate.
This also assumes that the same organization even owns the bug in question. Not all of these defects may be Microsoft's problem to begin with. This might even be a MORE reasonable action for them to take, since they're doing "everything in their power" to fight the problem rather than just sitting on their hands waiting for a 3rd-party to correct their bug, and sitting on their hands longer waiting for the end user to update their software.
why use MSN at all?
I don't suppose it's occurred to Microsoft that .info is a perfectly valid TLD used by a significant number of legitimate web sites, and a perfectly appropriate string to include in an IM discussion.
http://alternatives.rzero.com/
Do they block those scary executable .com files too?
Here's one it started doing since the recent MS security drive. Any file that could possibly exploit a hole in any piece of software seems to be treated with serious suspicion. Somehow, this seems to include GIF files. So, when someone tried to send me a GIF file, I get this warning. I download it anyway, and it's sitting on my hard drive. I can copy it somewhere else, open it, etc.
However - and this is the kicker - when I click on the blue link to the file in the MSN chat window, I get this dialog. Yeah, it actually DELETED the file I just downloaded. After I copied it using Explorer. And I have full access to it. Dunno who implemented that piece of genius.
== Jez ==
Do you miss Firefox? Try Pale Moon.
...as a web developer I need to find a new IM service? Great move. :P
The first person that got infected wiht something would bitch that Microsoft didn't do enough.
Not that im fond of them either, but it seems they cant win either way these days.
---- Booth was a patriot ----
It's pretty much impossible to block everything. If someone really wants to send you a link to something that will infect (or try to infect) your computer, there are tons of ways to do it. The tinyurl example has already been mentioned, but every single Apache server out there comes with things like mod_rewrite or Redirect directives that can send innocuous URLs to the intended malicious URL. In the case of mod_rewrite, you can do it without even changing what the browser displays, so users don't even know they evaded (or didn't, as the case may be) an infection attempt.
Personally, I'd rather they fix the vulnerabilities that make those strings dangerous in the first place
At least their trying something (albeit a weak approach) to stop automated scripts from sending viruses all over their chat protocol.
When you work on 1000+ college student laptops, you learn a lot of things about software students use in general, and one of these things you learn is:
1) AIM is a Virus downloading service disguised as a chat protocol.
I know that AOL doesn't do this on purpose, but it is so easy to hack that it might as well be. it's great when a 12 year old downloads a virus that infects Aim thinking it was some game (probably from AIM i might add), it sends "Hey check this out!" to his sister at the college containing an infected link or program, and the next thing you know you're running Aimfix and cleaning Zlob off on 300 PC's.
If Aim would simply filter out the bad traffic (and they should be able to know if a client is spamming the servers like crazy by heuristics alone) it would stop a lot of scams dead in their tracks.
In Soviet Russia, Trojan exploits YOU!
This has been known about for years. Here's a digg posting from over a year ago...
.... does the same stuff. I try to send a coworker the name of an exe or a dll and it shoots back that my message could not be sent. So even in a closed corporate environment stuff like this happens. Of course there probably is a way to turn that off at the server side, but our IT department has better things to do like hunting down copies of WinRAR and send us threating emails because "WinZip is our corporate standard compression tool."
It's probable that they're seeing a lot of automated traffic with these URLs. They know for sure that these are malicious networks and they're spreading on their IM client. Maybe they already patched the vulnerabilities, but these are people who have (apparently) not set auto update to work. Maybe they plan to fix it in the next roll-up but need a stopgap in the meantime. It's not hard to imagine an ethical scenario where you pretty much have to block that traffic. Now the question becomes how. I'm not sure I agree with the silent blocking or the indiscriminate targeting like .info, but the very fact that they're blocking known attack vectors I don't think is a bad idea.
I've about had it with Google's spying, Microsoft's spying/interference, Yahoo's spying, and pretty much everything and everyone else that is working to profile ad nauseum.
You can set up your own server, you can control your own IM stuffs, and really ... it's just a better solution. You could still go with GTalk if you want access to the Jabber network without setting up a server or doing anything fancy, but in that case I'd recommend encryption for your conversations (you should probably do that anyway). If you just want to set up a new Jabber account on one of the public servers, head on over to jabber.org and pick one out.
I'd recommend Gajim in Gnome or Psi in KDE or Windows. The only real advantage to using Google Talk is that it enables voice calls to oher Google Talk users but there's a summer of code project to get that in Gajim too and Psi is also getting this soon. Jabber is the future.
I wonder if MSN also spies on users. Do they have keywords in place to log messages related to possibly competing products, etc?
Perl.
Still, the administrator of a server running PHP 5 can get scripts to run without having .php in the URL by using various forms of content negotiation:
Anyone who knows me knows that I haven't used windows since 1999. I simply can't stand the system, nor can I stand the corporation behind it.
.. should we try to protect, or should we ignore those that do not upgrade their systems? The cynic in me tells me : "Let them be cracked". The humanitarian in my tells me: "Well, think of the victims of the DDOS attacks from the botnets of previously-vulnerable people".
.. or IRC for that matter. Heck. PLEASE go back to IRC. It's still the best means of communication there is.
However. I'm also interested in computer security.
It _MAKES SENSE_ to block stuff that has been observed in automated worms. It's a simple solution. It's not something that will make all systems invulnerable - but it _MAKES SENSE_. It's a quickfix. A quickfix that works.
This is only "censorship" insofar that it actually prevents stupid automated worms to spread. It's a defensie measure. Not a perfect one, but one.
Oh, and patching the holes. Sure. You can patch the holes. Then everyone has to update
I'm dead tired of _idiots_ who thinks that any preventative measure is evil! censorship! bad!
Microsoft is simply trying to help in this case. If you do not like it, use another IM service. Like Yahoo!
So, please you censorship-screaming morons:
SHUT UP! STOP USING THEIR SERVICE IF YOU DO NOT LIKE IT. THEY ARE TRYING TO DO THE RIGHT THING IN THIS INSTANCE !
*phew*. Now I have to go wash my brain. I've just defended satan.
"Rune Kristian Viken" - http://www.nwo.no - arca
Someone want to tell me how you fix a user who downloads and runs untrusted executable code?
I've seen plenty of Linux n00bs get tricked into running rm -rf /. Or lynx -source example.com | sh
MSN implementing filters on certain strings is just a small measure in a huge arms race any major IM system has to deal with.
PS. You can save yourself the trouble of replying if you're going to tell me Linux only allows the user to destroy all of his files and not the entire OS.
Amazingly enough, I just discovered this bug in Lotus Sametime a couple of days ago. Whenever I sent a message with a filename ending in .scr, it sent a blank line to the recipient instead. I haven't verified with any of the other identified strings. Maybe there's a common piece of crapware they're both using?
I ran into this problem a few months pack, trying to paste the url http://www.scrapheap-challenge.com/ to a friend of mine. Absolutely refused to send unless I put a space in there somewhere.
These vulnerabilities come from creeping featurism. It's better for their
business model to have all these neat features, even if no one uses them.
Everyone who upgrades is hoping for bug fixes, not new features, but
M$ themselves have said of course they like the current model that keeps
the bucks flowing without them having to make this stuff safe or even work
correctly. They know people are looking for fixes, but not providing them
is what keeps the suckers on the treadmill of upgrades. Hey people -- software
doesn't really wear out or anything like that, especially well written stuff.
Some decisions made a long while back make it virtually impossible for them
to make all this safe in any normal meaning of the word. OLE (then activeX and then COM)
come to mind, as well as the ability of any app to broadcast messages (including
"shut down now" or "eat all this data") make it impossible to make things
safe unless they are disabled. There go all the "features" so it isn't going
to happen.
M$'s approach to "security" included for example, breaking DOS on Win2k in SP2
as it had access to hardware and therefore was unsafe. Never caused us a problem
as we were always careful. But -- to replace our old but perfectly serviceable
DOS CAD software would have cost over $20,000. So we now run it in Linux under
a dos emulator. And we're pitching windows completely out of our shop as it becomes
possible -- we still keep a few dual-boots around to support windows software we've
written for customers but we boot to Linux by default and choice.
At least in Linux, when there's a feature, it was thought out re too-easily-installable
insecurities.
Theres more than one way to do it, in nearly every case.
...that MSN allows the user to to run things it never should. Or in other words, one should be reasonably expect that using MSN Messenger won't screw up their machine. You should be able to feed it any number of Url from anywhere, trusted or untrusted sources, and it shouldn't do anything bad let alone second guess whether or not the information sent is "good" or "bad". Here is a hint: Untrusted data sources serve untrusted data. Why does Microsoft consider it a feature that MSN Messenger blindly run any files fed to it? And "asking for confirmation" is not sufficient.
Having any IM program make it so easy to run applications from questionable sources is not a secure feature let alone the debate whether or not it is a good one. Asking "Run this? Yes/No" doesn't make the feature any better. Why do people keep thinking it is? MSN Messenger shouldn't be doing this period where the "fix" of filtering on "bad data" by extension is laughable.
perhaps you should consider exactly why it is that you think IRC is the best means of communication. Seriously? You think IRC is the best means of communication? No wonder I have so much trouble communicating with someone by going up them and talking to them in person. I should try using IRC next time. Communication always works so much better when there's no pesky voice inflections or body language to deal with, and when there's things like network lag or netsplits. I find I always get my point across when the other person sees half of my message 5 minutes later, and then I disappear in the netsplit before getting the rest of my thought out. You're right, IRC is the best.
This isn't at all new. A few friends and I discovered at least one of these independently over a year ago, and we then found it was a known but little publicised situation before that.
Worse, after they get their own machine hacked, they'll blame MSN. They'll contact whatever 'customer service' facility is provided and scream bloody murder. If they manage to get fired as a result they may even sue. Don't doubt that there are employers capable of getting litigious with MSN over it, also.
Sadly, this is the reality of operating an IM/Email/SMS service today. Look carefully at that graphic realize that it is not an exaggeration.
Lurking at the bottom of the gravity well, getting old
This has been going on for years. PIF at least was censored out about 2 years ago after a virus went around. It's not all bad though, now you can PIF a conversation. When you want to end a multiuser chat, type in *.PIF and everyone will be knocked out.
The solution?
Apply some idea of "common carrier" status to MSN. Like the telephone companies, as long as they do not attempt to edit or censor the content that passes through their networks, in any way, then they are not responsible and cannot be held liable for any damage caused by such content. But the moment they start taking measures like this to try to "sanitize" the content of the network, make them legally liable to pay damages for any successful attack/exploit that they are unable to prevent.
Overnight, this stupidity would go away. It would also set a great precedent for any other companies that wish to do this.
It is a miracle that curiosity survives formal education. - Einstein
joe | optimism is just another word for false hope says: (18:57:18)3 11216
http://yro.slashdot.org/article.pl?sid=07/08/05/1
joe | optimism is just another word for false hope says: (18:57:25)
I am now going to disprove this article
joe | optimism is just another word for false hope says: (18:57:27)
*ahem*
joe | optimism is just another word for false hope says: (18:57:52)
Microsoft suck massive donkey cocks. I really, really hope someone kicks Steve Ballmer right in the fucking head, preferably with a steel toed boot
joe | optimism is just another word for false hope says: (18:58:23)
Really, I hope someone burns their shitty excuse for a building to the ground. Fucking cunts.
Messages got through OK. Dunno what the problem is, personally.
By summer it was all gone...now shesmovedon. --
Pidgin
http://sourceforge.net/projects/pidgin/
(formerly Gaim), see also
http://en.wikipedia.org/wiki/Pidgin_(software)
works fine with MSN.
Only issues are security, (passwords stoed in plaintext - as with most other IM apps) and peer to peer file not working yet via MSN, (goes via servers so is slower). Neither are major hinderances.
* First they came for the MSN users and I did not speak out because I was not an MSN user.
... actually they couldn't do fucking anything to Jabber. ;-)
* Then they came for the AIM users and I did not speak out because I was not an AIM user.
* Then they came for the Yahoo! users and I did not speak out because I was not a Yahoo! user.
* Then they came for us, the Jabber users, and
As a side note, the server can't read/block your IMs if they are encrypted. Why aren't you securing your communications in the first place? Pidgin Encryption -> http://pidgin-encrypt.sourceforge.net/
I suppose this is *yet another* good reason to use IRC
-pp
I made the choice of using ".info" for my DSL server. I know a college that bounced email if it has ".info" in the BODY of the email.
I'm the project owner of the msnmsgr project at MozDev, and I looked into this. I don't know what version of the protocol Adium uses, but mine uses MSNP8. When my message contains one of the things it censors, the switchboard server immediately closes the connection. It's not just censorship; you get booted.
Stop using MSN and use jabbber or something.
Isn't this news *really* old? I thought these strings have been blocked for years now, or so I recall reading about them a long time ago.
The real problem is between the keyboard and the chair. If someone sends you a URL of http://www.example.com/badstuff/newscreensaver.scr with the message "Really great, you have to try this out!" and the person downloads it, runs it, installs it and infects their computer how can any "security" in Windows (or any other operating system) help this poor deluded user?
Face it, this problem has been around since the first "general purpose" computer fell into an untrained user's hands. Someone handed them a floppy with something they just had to see on it and got their computer screwed up. The methods of infection have improved somewhat - the education, knowledge and skill of the user has not.
I don't see a defense here without making the computer unchangeable by the user.
So you're saying MSN is bad? Gosh, I had no idea! Quick, let's all switch!
Hey, I just heard there are all these open standards that you can use to chat with one another! You won't be dependent on the goodwill of a single company, you needn't worry about peolpe sniffing your messages, and there are lots of other advantages, too!
Guys? Gals? Why is nobody coming with me...?
Please correct me if I got my facts wrong.
* .info .scr (source)
.asp filters? Or is windows mostly vulnerable to php?
* profile.php? (including '?')
* download.php? (including '?')
* gallery.php
* pics.php
* ListAllTopics.php
*
Where are the
I think you underestimate just how much I just dont care.
Anyone think maybe it's just a spam filter? I don't use IM of any kind (IRC etc) but when I HAD to in the past I received a lot of spam IM. If 90% of the spam IM has these strings in it (an exaggeration to be sure) then why not stamp it out? I'm sure you wouldn't complain too much if the message you sent to your GMAIL account with the subject 'replica watches with pharmaceutical hudia' didn't go through. I think a good test would be to try the string "Bill Gates sucks Steve Jobs cock", if this makes it through well then, everything important works.
Yeah, my name is Peter Richard (Last name omitted), so imagine the fun I've had.
I don't suppose it's occurred to Microsoft that PHP is a perfectly valid scripting language used by a significant number of... No, of course they wouldn't. To Microsoft, real websites use ASP.NET...
I mean, I frequently send links to specific webcomics to people I know on IM, but most of the people I know are on Yahoo or something better.
Don't thank God, thank a doctor!
It's still moronic, and I still think MSN should stop doing it.
And I will keep bringing this up to people who use MSN until either MSN stops, or everyone I know is using some other IM client.
Don't thank God, thank a doctor!
If they are applying censorship criteria they are also MONITORING what you type... just something to think about. IM = "Instant Monitoring"
http://xs218.xs.to/xs218/07310/censorship.jpg Don't kill me because the screenshot features Digg, but I tried sending these myself and my partner on the other end got them just fine. I wonder if this censorship is just situational or happens to only some people, and/or happens at random times.
Dance Dance Revolution.
kakaroto from the amsn project somehow obtained the full censored regexp list. There are about 90 in total.
t =157&postdays=0&postorder=asc&start=30
http://www.amsn-project.net/forums/viewtopic.php?
....msmsgs.exe
I remember submiting similar story about 1.5-2 years ago and it got rejected. The only difference is that now MSNM tells the message couldn't be sent, back then it simply got censored (more times than once I pasted url with download.php? to friend and asked a bit later if they had already downloaded it to direct them further and they were like "Downloaded what?")
It's the latest update (July) that introduced this. I hadn't upgraded but a friend did. He could no longer receive MP3 files (We're game developers; Our sound files are all MP3 format! Nothing illegal here!!!!!!!)
Zipping is the way around this filter.
Anyone that I have any relation with knows that I will not contact them via MSN, AIM, My Space, Live Journal or any of their like. You must be ever so much fun at parties! I suggest that they learn to use IRC or obtain a HAM radio license with a morse code rating, and I will gladly send them an instant message. [...] If they do not find a medium that is commonly available and required for business communications as aceptable, then I really don't want to be associated with them. Bah Humbug!
Make sure they don't waste any of that coal in the chimney, too!
You can't take the sky from me...
So some of what they arbitrarily block is for asinine security reasons? When hackers come up with the key to a Microsoft owned DRM ploy, wanna bet that string will also be blocked, server side, for security?
You can't take the sky from me...
Do you really think they're diverting resources away from fixing bugs so that they can add "censorship" features to IM? Perhaps this is just one effort among multiple efforts to correct problems AND mitigate their effects?
test.info12:45
Could not send; a connection error occurred.
They did not correct a problem, they created a new one.
How hard would it be to have a message "could not send, content of message is not allowed"?
It would cause people to realize there is something wrong, rather than blaming it on the dog, as they choose to do. So they censored that tidbit by censoring our messages, the bastards.
You can't take the sky from me...
my bet is that the parent poster is a developer or a DBA. the "devs vs. IT" battle is an old one. i'll sum it up: IT guys are fascist pigs, and dev's are whiny spoiled brats. (see also: video conferencing vs IT, R&D vs. IT, and IT vs. the NOC) it's true, everyone really needs to lighten up :-)
it's wrong for people to subvert IT policies. it's wrong for IT departments to implement policies that people have to subvert in order to do their jobs. as we all know, two wrongs don't make a right.
there are two ways to fix the problem:
one way is for IT to exchange compliance for support. IT agrees only to support compliant machines. it will not support non-complaint machines, nor will it remove them. if you want to be a local admin and download tons of crazy crap from the net, go ahead, but you have to provide your own support for your issues. if you have a problem that you can't fix, IT will happily ghost your machine back into compliance or repair any defective hardware. if it has been determined that your machine has done something wrong (transmitted a virus, contained material that puts the company at risk of legal action) then we will pull your network connection until your machine is complaint once again. a clearly defined and easily referenced policy of "quid pro quo" support makes life easier for the IT department and can afford some much needed freedom for the "lone advanced user" who so often runs afoul of draconian IT practices.
the other option is to the separation of development and corporate assets. a development network with few restrictions is available, but it will have no access to or from the corporate LAN or the production environment. all machines on the development network are the sole responsibility of the developers. the DevNet is managed in some manner to keep corporate machines out, and the CorpNet is managed in a similar manner to keep the development machines out (no switching network cables you naughty devs!) the IT department can then administer uniformity on CorpNet until it is blue in the face, and the devs get to be free to do as they please on the DevNet until someone gets sued or arrested.
in both cases, people who think they are smarter than the IT guys get to do as they please and must play ball in order to get support. hilarity ensues whenever one group has to turn to the other for help.
sarcasm:
-noun
1. harsh or bitter derision or irony.